unkin-agent
b5e68da270
Ship a distroless image so the plugin can run in-cluster in serve mode, letting developer laptops use the shared cache without S3 credentials. - Dockerfile: golang builder running `make build`, distroless static nonroot - `make docker` for a local smoke build - `.woodpecker/docker.yaml` pushes to docker-internal on tag - README: image name and the SSL_CERT_DIR mount the internal CA needs
go-cache-plugin
Build repo for tailscale/go-cache-plugin,
a GOCACHEPROG implementation that backs the Go build cache with S3. Upstream
publishes no releases, so this repo pins a commit via the tool directive in
go.mod and ships the static binary as a Gitea release.
No source of its own. To move to a newer upstream commit:
go get -tool github.com/tailscale/go-cache-plugin/cmd/go-cache-plugin@<commit>
make test
Build
make build # dist/go-cache-plugin, CGO_ENABLED=0, stripped
make test # builds the binary, then drives a real `go build` through it
Use
Point it at the estate's Ceph RGW, which needs both a custom endpoint and path-style addressing:
export GOCACHEPROG="go-cache-plugin \
--cache-dir=$HOME/.cache/go-cache-plugin \
--bucket=go-build-cache \
--region=default \
--s3-endpoint-url=https://s3.ceph.unkin.net \
--s3-path-style"
go build ./...
Credentials come from the usual AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY
environment. Every flag also has a GOCACHE_* environment equivalent — see
go-cache-plugin help environment. Add --metrics to print cache hit rates at
exit, and --expiry to age entries out.
For a shared cache daemon, run go-cache-plugin serve --plugin <port> once and
have each build use go-cache-plugin connect <port> as its GOCACHEPROG.
Container image
artifactapi.k8s.syd1.au.unkin.net/docker-internal/go-cache-plugin, built and
pushed on tag. Distroless static, nonroot, no shell. make docker builds it
locally.
The image carries only the public CA bundle, so a serve-mode Deployment must
mount the internal CA and point Go at it:
env:
- name: SSL_CERT_DIR
value: /etc/ssl/internal
s3.ceph.unkin.net is issued by unkin.net Intermediate Authority; without
that mount the S3 client fails with x509: certificate signed by unknown authority.
CI
Woodpecker steps fetch the released binary:
commands:
- curl -fsSLo /usr/local/bin/go-cache-plugin https://git.unkin.net/unkin/go-cache-plugin/releases/download/v0.1.0/go-cache-plugin-linux-amd64
- chmod +x /usr/local/bin/go-cache-plugin
Release
make patch|minor|major tags and pushes; the tag pipeline builds
linux/amd64 and linux/arm64, attaches them with sha256sums.txt, and
pushes the container image tagged with the git tag and latest.